public inbox for [email protected]
help / color / mirror / Atom feedFrom: Dominique Devienne <[email protected]>
To: Guillaume Lelarge <[email protected]>
Cc: [email protected]
Subject: Re: SET LOCAL ROLE inside SECURITY INVOKER (LANGUAGE plpgsql) function
Date: Thu, 31 Jul 2025 13:37:37 +0200
Message-ID: <CAFCRh--tSWRRCMvtSovtRDX1wce5KCOutaDRBD5JKWb9atLC_w@mail.gmail.com> (raw)
In-Reply-To: <[email protected]>
References: <CAFCRh--AXoYUj8-WDuWpUcWXC0UNAL9gjbTp=1hU-NJhRyR0vQ@mail.gmail.com>
<[email protected]>
<CAFCRh-9AzsOBd6cPFsgmbw=Mf3nN5tHj9YYQQHZG0XqxDSMK=Q@mail.gmail.com>
<[email protected]>
<[email protected]>
<CAFCRh-8D+R=xufTFYN8SDDeEVwDNCb7kcspt9hsRW2T-QOMoKg@mail.gmail.com>
<[email protected]>
On Thu, Jul 31, 2025 at 11:35 AM Guillaume Lelarge
<[email protected]> wrote:
> On 31/07/2025 10:41, Dominique Devienne wrote:
> > On Wed, Jul 30, 2025 at 9:42 PM Adrian Klaver <[email protected]> wrote:
> > how can has_table_privilege() "lie" like this?
>
> It doesn't lie. The role has DELETE privilege. I guess what it lacks is
> the SELECT privilege. If you do a "DELETE FROM ... WHERE ...", you need
> the SELECT privilege to perform the WHERE. Without "WHERE ...", it would
> work without the SELECT privilege.
Right on the money! Merci Guillaume!!! --DD
PQ: NOTICE: can DELETE = t
PQ: NOTICE: can SELECT = f
view thread (11+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected]
Subject: Re: SET LOCAL ROLE inside SECURITY INVOKER (LANGUAGE plpgsql) function
In-Reply-To: <CAFCRh--tSWRRCMvtSovtRDX1wce5KCOutaDRBD5JKWb9atLC_w@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox